edca9e46928c830db5bb893356c5aa8b1b109d6a66fce793a090ec51dc081d7c

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IT/SISTEMA.DI.SICUREZZA/CARD/vbv_files/saved_resource.html
Size 465B
Sample260722-pgzabavare
SHA256 edca9e46928c830db5bb893356c5aa8b1b109d6a66fce793a090ec51dc081d7c
MD5 a957d82fc710096674528a8ad9da83c7
SHA1 3cad837ba69db7065587392f2dafd903430352ea
SHA512 c72ba0729db18b4b501a0b08a1577cd4d69bf954358ca0c65606f9fbbef978429af07531c508c8c07da29c020f93a2ea225582c3bed2d51d23f41a2c07572fa6
TLSH
T11EF05CB6690B8CBB1520F9C2FBC4799457509C74B08D1CD5E44C344C74EAB95CD63B28
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1852	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291963361609377"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{988CC0F0-2172-4369-AADC-D16B228CFE75}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe
6112	msedge.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 6112 wrote to memory of 4216	6112	msedge.exe	84
PID 6112 wrote to memory of 1852	6112	msedge.exe	85
PID 6112 wrote to memory of 4184	6112	msedge.exe	86
PID 6112 wrote to memory of 5332	6112	msedge.exe	87
PID 6112 wrote to memory of 4184	6112	msedge.exe	86
PID 6112 wrote to memory of 4184	6112	msedge.exe	86
PID 6112 wrote to memory of 5332	6112	msedge.exe	87
PID 6112 wrote to memory of 1280	6112	msedge.exe	88
PID 6112 wrote to memory of 1280	6112	msedge.exe	88
PID 6112 wrote to memory of 1280	6112	msedge.exe	88
PID 6112 wrote to memory of 2436	6112	msedge.exe	89
PID 6112 wrote to memory of 2436	6112	msedge.exe	89
PID 6112 wrote to memory of 2436	6112	msedge.exe	89
PID 6112 wrote to memory of 864	6112	msedge.exe	94
PID 6112 wrote to memory of 864	6112	msedge.exe	94
PID 6112 wrote to memory of 1436	6112	msedge.exe	95
PID 6112 wrote to memory of 1436	6112	msedge.exe	95
PID 6112 wrote to memory of 1476	6112	msedge.exe	97
PID 6112 wrote to memory of 4616	6112	msedge.exe	111
PID 6112 wrote to memory of 4628	6112	msedge.exe	112
PID 6112 wrote to memory of 4520	6112	msedge.exe	113
PID 6112 wrote to memory of 3828	6112	msedge.exe	114
PID 6112 wrote to memory of 3828	6112	msedge.exe	114
PID 6112 wrote to memory of 1764	6112	msedge.exe	115
PID 6112 wrote to memory of 1764	6112	msedge.exe	115
PID 6112 wrote to memory of 4864	6112	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\IT\SISTEMA.DI.SICUREZZA\CARD\vbv_files\saved_resource.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffbc85dc188,0x7ffbc85dc194,0x7ffbc85dc1a0
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,17808487740096095302,201211148853774366,524288 --field-trial-handle=2292,i,10115009545817776041,3599033497323282741,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1860,i,449659991379519553,13495369715536835483,262144 --field-trial-handle=2292,i,10115009545817776041,3599033497323282741,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,15718006628801631188,5417517291048033012,524288 --field-trial-handle=2292,i,10115009545817776041,3599033497323282741,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,3672740184673046474,14066656978885290668,2097152 --field-trial-handle=2292,i,10115009545817776041,3599033497323282741,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,8962845020976557528,13071325570146929064,2097152 --field-trial-handle=2292,i,10115009545817776041,3599033497323282741,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,8697188739052148640,10814529896941122180,524288 --field-trial-handle=2292,i,10115009545817776041,3599033497323282741,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,6109411693900841523,17530565950612829220,524288 --field-trial-handle=2292,i,10115009545817776041,3599033497323282741,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,12439232257850876293,15299110831742241077,524288 --field-trial-handle=2292,i,10115009545817776041,3599033497323282741,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,12439232257850876293,15299110831742241077,524288 --field-trial-handle=2292,i,10115009545817776041,3599033497323282741,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,14987781539603386426,11881172016685581188,524288 --field-trial-handle=2292,i,10115009545817776041,3599033497323282741,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,50013908227772243,9015254292662231547,524288 --field-trial-handle=2292,i,10115009545817776041,3599033497323282741,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,6035446521394463378,17918885019691460315,524288 --field-trial-handle=2292,i,10115009545817776041,3599033497323282741,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,11898842315471942107,7865855356424999435,524288 --field-trial-handle=2292,i,10115009545817776041,3599033497323282741,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,10347135750655145684,4293593875827934722,524288 --field-trial-handle=2292,i,10115009545817776041,3599033497323282741,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4928,i,11242719454055194020,1387201574855036667,262144 --field-trial-handle=2292,i,10115009545817776041,3599033497323282741,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7b44241a-443c-43a3-b1c9-27c3550e4222.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7b44241a-443c-43a3-b1c9-27c3550e4222.tmp
Size 24KB
SHA256 23c840a894fec30f4a7dc4b995e8ff4cc5020c8548ab6026a48bc88cd90c8a1b
MD5 6043bb60ea7e9127cd03917ce7ca0c67
SHA1 c4a0b023043bf1b35715ca2ee13fcd3911647f5b
SHA512 16fa30b4e3b4999ee6ca79eb2fc3fbd87b6a777dddcb15c0efc6acde7c4fb13b5c9cc74b9d60ce5e554a13a8c0b24967a5da3dc5a5fb72b8617047e539468c56
SSDEEP 384:npNiF9CcmyWCs3sNj8TUNTUlIm2QckCr9lKKphBftGnIepae4KV8p0mHpty/7IgI:pEFccps3mwgbkUQk1GIRI8p0wd
TLSH
T1A5B25B36DC58C9BBECE74F99BB4A7A03DEE01267869C99D4DAD81D0D10871DC070B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 56174dba45c78909e805b2340c93ed6a4b44844a3ca21423a09449b3b0f6ef6a
MD5 9614f9f5efb7cd41678779887b5d80a8
SHA1 3f1c9157e0f7f112a49f07e776a8e6068781276b
SHA512 df9a0d9ac148883813d6bd63cb8e58f0926df256b4de1611e6bdfb7962cb743049dff34d4a4e24707550e241763001e6982d5bb6956cd43b965e725f605707cf
TLSH
T1CAE022BAD822EC3719FD0B2AB0098746E71013573B40895F3B3C820D8FB162B46C98AC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c6b58df215dc4df441fefe830ace28124bf130277f9df83e296520b1d16038fd
MD5 86db2cf48c3e62d8e2b1af79dc018fbf
SHA1 3ca31b1f9b0729a328b84c963f83da235297590f
SHA512 7517c37e64f205d4c5260b87d910e7277d3214c04ed46b442b3a678e3c61c3cc4461b9671590d9d24ab50683b1bb459a8ef522d03a72682d3567047fafe1bba3
TLSH
T1B631C2F783F4856ECA1196F0AA18BE2FCE1D0511432C7DAAC5E4AF1793E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3020aeb383f762c288b98f66099c87d84dcb5bcb2c87718855cf2631cca3d117
MD5 b14e3d8bffef8491712f75a5a8e2e8e6
SHA1 f6846636b868e2a1140cb8c1b1befa833349f4a3
SHA512 4ca232e425cd5e550926cab554a57381d210ea907bdd2bad45b8fde8bf0fee15b6446372343de8f70cdfce4cd4a2a334fda5acc96b055c0e1946c927fd9361d8
SSDEEP 192:sxZXQRMyMqZjK1Ml8UQxkFT/fNsecZdiNzodpHcHW6+WNGYvsvZj/Ig5aUJ:sxZAJqCZ/fNseczH8HbG5T8Y
TLSH
T13162E8166A389977DCDBD209F645BB53D6F91173E2944E44A9FCCA0C04E7AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 573b7aa91c7652450d4048e7d93cbf63a245595e1cb770bf6a231bc36b165ae9
MD5 8ea06c66341997d7f8bf40870fef9a32
SHA1 bfcdaa2aadbfa98639a9d4782d41cbe18b082513
SHA512 fc8447b548ac9296e9a9fd9fdcd3314db5445a429bb2d2573410ea5169614c3537cc9c975b93e20a966c627002aa81d1a3c5256c9e0b3d992632723ca4c6a10b
SSDEEP 192:sxZXQRMyMqZjK1Ml8MkFT/fNssoqaZdiNzodpHcHW6+WNGYvIuvPj/IgjUJ:sxZAJMZ/fNssoqazH8HbGUTjY
TLSH
T13962E8066A349977DCDBD209F645BF53D6F91173E2944E449AFCCA0C04E6AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 369beea6ff075f350a01e8a7669ddb24772e3b0bdd666160762765fd960ee8a7
MD5 8de96672c21e87ea4435219773382be5
SHA1 d507e4c20b0aeb99859a661596064629553aa005
SHA512 f909dc1fe70eda2c9e746a72fc7a59a0a24fb307539f5c94ebf10b0502434a98cc1fc6f875fa8fc0db5650d5b51f2a03b080b259ce6569ad73d419694c3c3918
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbG7:05ppxnY753RNBvRJJdt7p5J9VlfP
TLSH
T11DB28C1A713E0212397E2948B39696364F4235A37058F4AF7FB814A54F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 418abaca23028d9440075269a9c9898703c5ddfdb5555745644de6e6770f88f6
MD5 52aeb8df5383a226d4ad18a0b086c9c7
SHA1 1c8e85b5ca0b1e6531e2c97bcfd7d57bb2281546
SHA512 65620a92744f186dcf9567d265e78f868ab3b2f50978f92da087543b249983b512a3762ff4c79e6ad3967f8ced9ee50048ce099977f5629adc56269cf7d272a7
SSDEEP 384:nxiF1tNn/s3n9SMF3sN48TUNTUlI4LQckCr17vuphBftGnv2BX/aScjmw7ty/7IS:YF1j+9F3twgak441Gv2Z/a1j+
TLSH
T137D24B36E894DDABFDE64B8AB74A3602EFE44163C68C5AC4D9D85D4D00C72ED430BD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 041b6ab306254d396b4127fea68a8c2264c15ab5f5a5fce50aef80a11cf6d503
MD5 179eaf504fa606b287f9dafe249b9a46
SHA1 a16476a7a79a9b7c208ed322831953a9208d2547
SHA512 e6632793c215bc17ff0f888e878ef5a34c44630e1939949a117300921569b00c9d3059420a6afe0d077f526e46f3d75194b9e2728a854d70ca0b77bde58a40e9
SSDEEP 384:nXiF1tNn/s3n9S53sN48TUNTUlI4LQckCr17vuphBftGnvU/aScjmw7ty/7Igz:SF1j+9s3twgak441GvU/a1j+
TLSH
T1F9D24B36D894DDABFDE74B9AB74A3602EFE44163C6885AC4D9D85D0D00C72ED430B929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8d17ade79ad996bc30b10b3da12f75218795ffdc08495a936e987358366e3979
MD5 5fc057ac4da0000d138d8b401a7e64fe
SHA1 995624f35b175ed4f3a171a42d62055a354c3aba
SHA512 67d979e70f3e5769f098ee8a378214c772c4443e806bb0e85a902eefcf8339d5695a5565bd5b498b8b32b3eae8ada77251b1edad900adc995bf1d7e7a6b347fc
SSDEEP 384:npsiF9CcmyWCs3sN88TUNTUlIm2QckCr9jTnphBftGnv8/ae4KV8p0mHpty/7IgI:pXFccps39wgbkUnp1Gv8/aI8p0wd
TLSH
T165C26C36DC58C9ABFCE34B99B74A3603DEE44267C68CAAD4DADC1D0D10971ED430B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0bd6bc6b8e6388d5473ee6be2f301451d0f21a4eb2138d492c169ff24d762ba4
MD5 6c73026cb32244a9dca22e9e81e69597
SHA1 57c912bdcd51e9c43394222124469475ff05ed1a
SHA512 be88c53e0c3d3c86a9206a66ceacd8adee078f6a78a264311bd9a6b2980734a0dbf378db881e8f1f92c8c5cfb36fcf665618b7e405d1dfbd951d206956f581ee
SSDEEP 384:npEiF1tNn/s3n9S53sN48TUNTUlI4LQckCrW7vuphBftGnvU/aScjmw7ty/7Igz:pfF1j+9s3twgakR41GvU/a1j+
TLSH
T195D25B36D894DDABFDE74B9AB74A3A02EFE44163C68C5AC4D9D85D0D00C72ED030B929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 311c13392c42bb093c896136d4a9248039e21a6d2d1a30153948e9defb27b01a
MD5 a8e9a96fa9d103edee4ab59c779b585f
SHA1 39a0498a28a3f1f49ea431bf74770e1453c30432
SHA512 f9a420f0f79c46869cfd409e7f8364145c48a4a70aa44c6688e06095bc456879d5ac554103bf2b770b2f87633c137937259711148f30ebde01182314832f8534
TLSH
T13C413B5CAAFA1148B3B76E5A6BF7A86D447FB9772E06C05E00110D4F0767A00C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download